Skip to content
OpenAdvisories
Medium ALAS2-2026-3192 1 CVE

Moderate: lcms2 security update (Amazon Linux 2)

Published Mar 2, 2026 · Updated Mar 19, 2026

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-29070: A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 lcms2 0:2.6-3.amzn2.0.3
Amazon Linux · 2 lcms2-debuginfo 0:2.6-3.amzn2.0.3
Amazon Linux · 2 lcms2-devel 0:2.6-3.amzn2.0.3
Amazon Linux · 2 lcms2-utils 0:2.6-3.amzn2.0.3

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-29070.html